diff --git a/cups-str4500.patch b/cups-str4500.patch
new file mode 100644
index 0000000..cabe572
--- /dev/null
+++ b/cups-str4500.patch
@@ -0,0 +1,16 @@
+diff -up cups-2.0.0/cups/util.c.str4500 cups-2.0.0/cups/util.c
+--- cups-2.0.0/cups/util.c.str4500	2014-10-15 12:59:27.105942488 +0100
++++ cups-2.0.0/cups/util.c	2014-10-15 13:03:38.618187112 +0100
+@@ -846,10 +846,10 @@ cupsGetPPD3(http_t     *http,		/* I  - H
+ 
+     snprintf(ppdname, sizeof(ppdname), "%s/ppd/%s.ppd", cg->cups_serverroot,
+              name);
+-    if (!stat(ppdname, &ppdinfo))
++    if (!stat(ppdname, &ppdinfo) && !access(ppdname, R_OK))
+     {
+      /*
+-      * OK, the file exists, use it!
++      * OK, the file exists and is readable, use it!
+       */
+ 
+       if (buffer[0])
diff --git a/cups.spec b/cups.spec
index 93413ab..f0a845c 100644
--- a/cups.spec
+++ b/cups.spec
@@ -11,7 +11,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.0.0
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: GPLv2
 Url: http://www.cups.org/
 Source: http://www.cups.org/software/%{version}/cups-%{version}-source.tar.bz2
@@ -65,6 +65,7 @@ Patch35: cups-ipp-multifile.patch
 Patch36: cups-web-devices-timeout.patch
 Patch37: cups-journal.patch
 Patch38: cups-synconclose.patch
+Patch39: cups-str4500.patch
 
 Patch100: cups-lspp.patch
 
@@ -261,6 +262,9 @@ Sends IPP requests to the specified URI and tests and/or displays the results.
 %patch37 -p1 -b .journal
 # Set the default for SyncOnClose to Yes.
 %patch38 -p1 -b .synconclose
+# Fix cupsGetPPD3() so it doesn't give the caller an unreadable file
+# (bug #1150917, STR #4500).
+%patch39 -p1 -b .str4500
 
 %if %lspp
 # LSPP support.
@@ -606,6 +610,10 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man5/ipptoolfile.5.gz
 
 %changelog
+* Wed Oct 15 2014 Tim Waugh <twaugh@redhat.com> - 1:2.0.0-5
+- Fix cupsGetPPD3() so it doesn't give the caller an unreadable file
+  (bug #1150917, STR #4500).
+
 * Wed Oct 15 2014 Tim Waugh <twaugh@redhat.com> - 1:2.0.0-4
 - Can no longer reproduce bug #1010580 so removing final-content-type
   patch as it causes issues for some backends (bug #1149244).